info.lionnets.com - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 34.248.143.225, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is info.lionnets.com.
TLS certificate: Issued by Starfield Secure Certificate Authorit... on May 23rd 2021. Valid for: a year.

This is the only time info.lionnets.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	34.248.143.225 34.248.143.225	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:10:... 2606:4700:10::6816:5f1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

2 34.248.143.225 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-143-225.eu-west-1.compute.amazonaws.com

info.lionnets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:5f1 (United States)

ASN13335 (CLOUDFLARENET, US)

app.cymulate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	cymulate.com app.cymulate.com — Cisco Umbrella Rank: 805367	179 B
2	lionnets.com info.lionnets.com	57 KB
4	2

	Domain	Requested by
2	app.cymulate.com	info.lionnets.com
2	info.lionnets.com	info.lionnets.com
4	2

This site contains no links.

Subject Issuer	Validity	Valid
info.lionnets.com Starfield Secure Certificate Authority - G2	`2021-05-23` - `2022-06-24`	a year	crt.sh
cymulate.com Cloudflare Inc ECC CA-3	`2022-01-09` - `2023-01-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://info.lionnets.com/index.php?id=61efc418f5c7ca3ff01616b3&tid=default
Frame ID: 89454FD20E8050C0D33BF9D271E274FB
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

57 kB
Transfer

63 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.php Show response
info.lionnets.com/ 10 KB
3 KB 367ms
223ms Document
text/html 34.248.143.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://info.lionnets.com/index.php?id=61efc418f5c7ca3ff01616b3&tid=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.248.143.225 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-143-225.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 26f491fc08db1c939bb509c74ea8c1a3f76d90c470b1a7e533addf14b7ccc613

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 27 Jan 2022 09:22:46 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

GET
H/1.1 200
OK plugindetect.js Show response
info.lionnets.com/ 53 KB
53 KB 74ms
74ms Script
application/javascript 34.248.143.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://info.lionnets.com/plugindetect.js
Requested by: Host: info.lionnets.com
URL: https://info.lionnets.com/index.php?id=61efc418f5c7ca3ff01616b3&tid=default
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.248.143.225 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-143-225.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 3fbaa10d3fcea3854e1dece2d4560ad99d5cf4dc6eb3da5aa42270b588ebe017

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://info.lionnets.com/index.php?id=61efc418f5c7ca3ff01616b3&tid=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 27 Jan 2022 09:22:46 GMT
Last-Modified: Mon, 07 Jun 2021 17:19:51 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "60be5537-d43f"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 54335

OPTIONS
H2 204 61efc418f5c7ca3ff01616b3
app.cymulate.com/api/phishing/clicked/ 0
0 143ms
88ms Preflight 2606:4700:10::6816:5f1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.cymulate.com/api/phishing/clicked/61efc418f5c7ca3ff01616b3

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:5f1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://info.lionnets.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 27 Jan 2022 08:50:33 GMT
content-length: 0
x-dns-prefetch-control: off
expect-ct: max-age=0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
x-xss-protection: 0
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST , GET , PUT , DELETE
access-control-allow-headers: Origin,X-Requested-With,Content-Type,Accept,Authorization,Set-Cookie
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6d40bbedfdd259cb-MXP

POST
H2 200 61efc418f5c7ca3ff01616b3 Show response
app.cymulate.com/api/phishing/clicked/ 0
179 B 68ms
68ms XHR
text/html 2606:4700:10::6816:5f1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.cymulate.com/api/phishing/clicked/61efc418f5c7ca3ff01616b3

Requested by

Host: info.lionnets.com
URL: https://info.lionnets.com/index.php?id=61efc418f5c7ca3ff01616b3&tid=default

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:5f1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://info.lionnets.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Thu, 27 Jan 2022 08:50:33 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-permitted-cross-domain-policies: none
x-dns-prefetch-control: off
x-xss-protection: 0
referrer-policy: no-referrer
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
content-type: text/html; charset=utf-8
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 6d40bbee8f8b59cb-MXP

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| PluginDetect object| plugins string| plugin object| xhttp

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.cymulate.com
info.lionnets.com
2606:4700:10::6816:5f1
34.248.143.225
26f491fc08db1c939bb509c74ea8c1a3f76d90c470b1a7e533addf14b7ccc613
3fbaa10d3fcea3854e1dece2d4560ad99d5cf4dc6eb3da5aa42270b588ebe017
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

info.lionnets.com Open in urlscan Pro 34.248.143.225 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

57 kBTransfer

63 kBSize

0 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

0 Cookies

Indicators

info.lionnets.com Open in urlscan Pro
34.248.143.225 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

57 kB
Transfer

63 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions